WO2023249515A1

WO2023249515A1 - Protection against theft of funds during payment by bank card

Info

Publication number: WO2023249515A1
Application number: PCT/RU2023/050153
Authority: WO
Inventors: Павел Владимирович КОРЧАГИН
Original assignee: Павел Владимирович КОРЧАГИН
Priority date: 2022-06-23
Filing date: 2023-06-22
Publication date: 2023-12-28

Abstract

Claimed are a system and method for protecting against theft of funds during contact and contactless payment by bank card. Protecting against theft of funds during contact and contactless payment by bank card includes: determining the location of the technical device used in an attempt to make a suspicious transaction; determining, from mobile geolocation information, the location of the communication means of the bank card holder at the time of the suspicious transaction attempt involving the holder's bank card; and sending information about the suspicious transaction in the form of an authenticated message to the communication means of an authorized representative of the bank card holder and authorized security and law enforcement agencies. The claimed technical solutions are directed toward improving the security of money transactions made by bank card.

Description

PROTECTION AGAINST THE THEFT OF FUNDS WHEN PAYING WITH A BANK CARD

The present invention generally relates to banking payment systems, more specifically to ensuring the security of transactions in payment systems using bank cards.

State of the art

Currently, the use of bank cards for financial transactions has become a common and widespread phenomenon in our everyday life. Bank cards are used to withdraw cash from ATMs, transfer funds, and non-cash payments for goods and services, both in stores through POS terminals and on the Internet.

The above-mentioned and similar transactions that are transparent to bank card holders are based on the most complex software and hardware systems of payment card systems. These complexes are generally distributed and interconnected with the ability to exchange data. The functioning of such complexes complies with numerous technical specifications and protocols and is regulated by current laws, by-laws and departmental acts, international treaties, which is described in detail, in particular, in the books “Plastic Cards”, Bystrov L.V. and others, 5th ed., Moscow: “BDTS-press”, 623 pp., 2005 [hereinafter referred to as D1] and “Plastic cards. Practical Encyclopedia", Andreev A. A. et al., Moscow: concern "Banking Business Center", 310 pp., 2nd ed., 1998 [hereinafter D2], Description of widely known ones (in particular, from [DI ], [D2]) aspects of payment card systems are not given in this description so as not to obscure its essence.

Due to the widespread use of bank cards and the expansion of methods of their use, as well as the growth in the number of environments in which transactions with bank cards are carried out, every year the issue of protection against various forms of theft of funds from bank cards through a variety of criminal schemes becomes more and more urgent. International payment systems are constantly improving methods of protection against fraudulent transactions; one of the most radical methods can be considered the use of chip technologies (EM V-standard bank smart cards) [hereinafter D3]. The main disadvantage [D3] can be considered the cost of implementing technology by issuers and acquirers, requiring the use of both appropriate chip cards and equipment (ATMs, POS terminals) that support the ability to service them.

Especially for the Internet, the international payment system Visa proposed the 3-D Secure security protocol [hereinafter referred to as D4]. This technology is an XML protocol that is used as an additional level of security as two-factor user authentication for online payments from credit and debit cards. Technology [D4] was developed for the Visa payment system in order to improve the security of Internet payments within the Verified by Visa (VbV) service. Services based on this protocol have also been accepted by payment systems MasterCard under the name MasterCard Secure Code (MSC) and JCB International as J/Secure, AmEx as SafeKey, Mir (NSPK) as Mir Accept. American Express added 3-D Secure on November 8, 2010 as American Express SafeKey in select markets and continues to launch it in additional markets. The Mir payment system launched its service in 2016. Academia's review of the protocol has shown that it helps address many security issues that impact the consumer, including the phishing surface area and liability shifting in the case of fraudulent payments. 3-D Secure adds another authentication step for online payments, allowing merchants and banks to further ensure that the cardholder is making the payment to protect against fraudulent transactions. The disadvantage of [D4] is that 3-D Secure does not guarantee the safety of funds on the card and is not an absolute protection of funds on the card during CNP (card not present) operations, for example, a one-time code can be intercepted by computer viruses. Also, not all banks support 3-D Secure technology, so many goods and services can be paid for by card without any with a confirmation code, which casts doubt on the effectiveness of this technology.

Also known from the prior art is the solution “System and method for protecting a bank card holder from overspending and theft of funds from his bank card in any environment for using bank cards” - RF Patent for invention No. 2695984 dated 08/21/2018, IPC class G06Q 20/34 ( 2012.01), author - Korchagin Pavel Vladimirovich (RU) [hereinafter D5], In [D5] a system is disclosed that contains for managing the parameters of a bank card that determine the possibility of authorizing transactions on it, interconnected with the possibility of remote data exchange and interaction of the issuer's processing center bank card, the acquirer's processing center, the plastic carrier of the bank card of the bank card holder, the means of communication of the bank card holder and his authorized representatives, with numbers registered in the issuer's processing center for the exchange of authenticated requests with the center and the method in which checking for an attempt to carry out unwanted or fraudulent transactions using the holder's bank card are carried out by his authorized representatives, with whom the issuer's processing center exchanges authenticated requests through the means of communication of authorized representatives to determine the feasibility of carrying out transactions requested using the bank card of their principal - the bank card holder.

The system and method according to [D5] reliably protect bank card holders from theft of funds from bank cards in any environment of their use in cases where the amount of the attempted theft by criminals exceeds the limit set on the bank card for the amount of a one-time debit transaction and/or the total amount of debit transactions within 24 hours. Accordingly, [D5] does not protect bank card holders from theft of funds from bank cards in any environment of their use in cases where the amount of the attempted theft by criminals does not exceed the specified limits, and the theft of such an amount may cause significant material damage to the victim.

The state of the art according to [D5] does not provide technical feasibility protection against theft of funds from a bank card in cases where the amount of the theft attempt made by criminals does not exceed the limit set on the bank card for the amount of a one-time debit transaction and/or the total amount of debit transactions during the day.

The essence of the invention

Initially, the existing ideology of using a bank card assumes that carrying out various money transactions using it is possible at any time in 24x7 mode. In fact, this leads to the fact that even when the holder of a bank card does not intend to use it, the bank card itself is in an activated state and represents a kind of open wallet that anyone can look into.

Since 2004, contactless payment using debit or credit cards, based on radio frequency identification (RFID) and near field communication (NFC) technology, has been gaining popularity around the world. To use the system, the consumer touches the payment card near a special symbol equipped with this technology at a POS terminal or ATM. The common technology symbol is similar to the Wi-Fi logo, but turned on its side. Contactless payment is considered a fast and easy payment method as consumers are not required to enter a PIN.

To protect user funds from possible theft by criminals, many Russian and foreign issuing banks have established limits for contactless payments without entering a PIN code from their bank cards in the range from 10 to 50 US dollars per individual payment. However, a significant gap in the security of contactless bank cards is that if the contactless card ends up in the hands of third parties and is not blocked by the owner, the person who finds or steals the card will be able to pay for purchases without entering a PIN code within the established limit an almost unlimited number of times. For example, with an Alfa-Bank bank card you can contactlessly pay up to 3 thousand rubles per transaction without entering a PIN code and carry out up to 999 such limited transactions per day. This vulnerability of contactless bank cards has been widely and widely used by criminals since their inception, using numerous methods of theft of funds from bank cards in any environment of their use, including dangerous forms of theft of funds using violent actions that are dangerous to the health and life of bank card holders. maps and witnesses to the crime.

According to the method according to [D5], the check for an attempt to commit a crime - one or another method of theft from the holder's bank card - is carried out by his authorized representatives. However, the system and method according to [D5] do not provide for the technical ability to protect against theft of funds during contact and contactless payment from a bank card in the following cases:

- when the amount of the theft attempt made by criminals does not exceed the limit on the amount of a one-time debit transaction established on the bank card;

- when the amount of the theft attempt made by criminals does not exceed the limit set on the bank card for the total amount of debit transactions during the day;

- when the number of theft attempts made by criminals does not exceed the limit set on the bank card for the number of expense transactions during the day.

The main objective of the present invention is to provide protection against theft of funds during contact and contactless payment from a bank card in the following cases:

- when the number of theft attempts made by criminals does not exceed the limit set on the bank card for the number of expense transactions during the day. The technical result of the present invention is to increase the level of protection of bank card holders from various types of theft of funds from bank cards in any environment of their use.

The specified technical result is achieved by the fact that the proposed system of protection against theft of funds during contact and contactless payment from a bank card contains:

Interconnected, with the possibility of data exchange and interaction, the processing center of the bank card issuer, the acquirer's processing center, the plastic carrier of the bank card of the bank card holder, a means of communication of the bank card holder with the number registered in the issuer's processing center, or interconnected, with the possibility of exchange data and interaction, processing center of the bank card issuer, processing center of the acquirer, plastic carrier of the bank card of the bank card holder, means of communication of the bank card holder and at least one authorized representative of the bank card holder, with numbers registered in the issuer's processing center.

In this case, the issuer's processing center and the communication means of the bank card holder are configured with the ability to exchange authenticated messages around the clock, or the issuer's processing center and the communication means of the bank card holder and at least one authorized representative of the bank card holder are configured with the ability to exchange authenticated messages in around the clock.

In addition, the issuer's processing center is configured to set limits on the size and number of debit transactions on the holder's bank card and, at least based on the established limits on debit transactions, a suspicious transaction is determined.

In this case, the issuer's processing center is configured to initiate verification of a suspicious transaction on the holder's bank card, at least in the case of a request from the holder's bank card expenditure transaction exceeding the daily expenditure limit on the current day, and/or the issuer's processing center is configured to initiate verification of a suspicious transaction on the holder's bank card in the event of a request from the holder's bank card for an expenditure transaction that exceeds the limit for a one-time amount of expenses, but does not exceed the daily expenditure limit limit, and/or the issuer's processing center is configured to initiate a check if the anti-fraud system or the issuer's fraud monitoring system, regardless of the presence and size of the established limits on spending transactions on the holder's bank card, calculates any suspicious transaction on the holder's card, characterized by , at least a new type of product or service purchased by the holder and/or an atypical sequence of events in which the holder’s bank card is used and/or an unusual location, including geographic, of use of the holder’s bank card.

Alternatively, the issuer's processing center is configured to search and determine the location of a technical device, at least a POS terminal, an ATM, a device for payments and money transfers on the Internet, through which a suspicious transaction was attempted from the holder's bank card, indicating at least a unique network address used to attempt to conduct a transaction of a technical device and the necessary data of its owner, as well as search and determine the mobile geolocation indicators of the location of the communication device of the bank card holder, at least at the time of the attempt to carry out a suspicious transaction from the bank card holder.

In most cases, the holder's bank card is made in the EMV card standard and has two interfaces for the possibility of contact payment by bank card with card entry, at least, in the POS terminal and contactless payment by bank card without card entry, at least at least in a POS terminal, with the ability to pay for purchases, at least when the card touches the POS terminal screen.

When using the holder's bank card for contactless payment, the issuer has set a limit on the one-time amount of expenses, if not exceeded, the bank card PIN code does not need to be entered.

As a means of communication for the bank card holder to exchange data and interact with the processing center of the bank card issuer, at least a smartphone is used - a mobile phone with a touch screen and a camera for photo and video shooting, complemented by the functionality of a pocket personal computer.

At a minimum, in order to access all user data and capabilities of the communication device of the bank card holder, a function of unlocking the screen of the communication device is installed on the communication device using authentication, at least according to the user’s biometric data, at least such as recognition by facial geometry and /or fingerprint recognition and/or iris recognition, and/or at least a digital screen unlock password is used as a backup or separate key for unlocking the screen of a communication device, and/or for access to remote receipt of banking services issuer, an application responsible for performing this function is installed on the communication device of the bank card holder, at least a mobile bank, for access to which at least the PIN code for access to the mobile bank and/or biometric data of the user is used, such as recognition by facial geometry and/or recognition by fingerprints and/or recognition by iris.

To authenticate the holder and authorize his bank card for a spending transaction from the holder’s card, the size of which does not exceed the spending limit established by the issuer, if not exceeded, it is not necessary to initiate verification of a suspicious transaction or enter the PIN code of the bank card, the processing center of the bank card issuer has the technical ability to provide the holder of the service of carrying it out additional authentication when requesting a contact or contactless spending transaction of any size from the holder’s card.

At the same time, to authenticate the holder and authorize his bank card for a spending transaction from the holder’s card, the size of which does not exceed the spending limit established by the issuer, if not exceeded, it is not necessary to initiate verification of a suspicious transaction or enter the PIN code of the bank card, the bank card holder has the technical ability, at least in your mobile bank, connecting the service of the issuer’s processing center for its additional authentication when requesting a contact or contactless debit transaction of any size from your card.

After connecting the service of the issuer's processing center for additional authentication of the holder when requesting a contact or contactless debit transaction of any size from his card, the issuer's processing center has the technical ability to respond to the holder's communication means to confirm the additional authentication of the bank card holder.

When the holder's communication device receives a response request from the issuer's processing center to confirm the additional authentication of the bank card holder, if the screen unlocking function is installed on the holder's communication device and at the time the response request is received, the holder's communication device screen is locked, confirmation of the additional authentication of the bank card holder is carried out by unlocking the screen of the holder's communication device, or when the holder's communication device receives a response request from the issuer's processing center to confirm additional authentication of the bank card holder, if the holder's communication device does not have the screen unlocking function installed or at the time of receiving the response request, the holder's communication device screen is unlocked, confirmation of additional authentication of the bank card holder is carried out by at least unlocking access to the issuer's mobile bank installed on the holder's communication device. Yu

Providing the means of communication of the bank card holder with confirmation of additional authentication of the holder, through the screen unlocking function, is carried out at least according to the user’s biometric data, at least such as facial geometry recognition and/or fingerprint recognition and/or rainbow recognition shell of the eye, or providing the communication device for the bank card holder with confirmation of additional authentication of the holder, through the screen unlocking function of the communication device, is carried out at least by entering the screen unlock PIN code, or providing the communication device for the bank card holder with confirmation of additional authentication of the holder, through the access function , at least to the mobile bank, is carried out by at least entering a PIN code for access to the mobile bank or biometric data of the user, at least such as facial geometry recognition and/or fingerprint recognition and/or recognition along the iris of the eye.

At the same time, providing the means of communication of the bank card holder with confirmation of additional authentication of the holder through the function of unlocking the screen of the means of communication or the function of accessing at least a mobile bank installed on the means of communication by entering biometric data of the user, at least such as recognition by geometry facial recognition and/or fingerprint recognition and/or iris recognition is carried out by turning on the following elements on the communication device of the holder:

- in the case of recognition by facial geometry - at least sensors, cameras and a dot projector, at the moment when a person looks at the screen and/or at the front camera of the communication device;

- in the case of fingerprint recognition - at least capacitive and/or optical and/or ultrasonic scanners, at the moment when a person places a finger or fingers on the specified area on the screen and/or communication device scanner; - in the case of recognition by the iris of the eye - at least a biometric scanner with sensors - sensors that read the pattern of the iris of the eyes and/or sensors, cameras and a dot projector.

In a situation where additional authentication confirms the identity of the bank card holder, the issuer's processing center has the technical ability to authorize and carry out the requested transaction, and in a situation where it does not confirm, the communication facility has the technical ability to offer several additional attempts at additional authentication, and in case of non-confirmation - the processing center the issuer's center has the technical ability to prohibit and block the requested transaction.

Alternatively, in the case where, after a certain number of attempts, additional authentication does not confirm the identity of the bank card holder, the holder’s communication device has the technical ability to photograph and/or videotape the face and/or record the biometric data of a potential attacker who is trying to carry out a contact or contactless debit transaction with the holder's bank card, and subsequent sending of the received data, at least to the issuer's processing center, and/or in the case when a spending transaction is requested from the holder's bank card, the size of which exceeds any spending limit established by the issuer on the holder's card, a means The holder’s communications has the technical ability to photograph and/or videotape the face and/or record the biometric data of a potential attacker who is trying to carry out a contact or contactless debit transaction from the holder’s bank card, and then send the received data to at least the issuer’s processing center.

Also, as an option, in the case when, when requesting an expense transaction from a bank card from the holder’s card through an ATM, additional authentication does not confirm the identity of the bank card holder, the ATM and/or the premises in which the ATM is located has the technical ability to photograph and/or videotape the appearance and actions potential an attacker who tries to carry out a debit transaction from the holder’s bank card, and then send the resulting photo and video materials to at least the issuer’s processing center.

In addition, as an option, in all cases where additional authentication does not confirm the identity of the bank card holder, the issuer’s processing center has the technical ability to generate all materials received upon the fact of attempting a suspicious transaction from the bank card holder, at least photographs and/or video recordings appearance and/or biometric data of a potential attacker, obtained through the communication means of the holder and/or the ATM and/or the premises in which the ATM is located, and the subsequent sending of such materials in the form of an authenticated message, at least to the means of communication of a trusted representative of the affected holder bank card and/or authorized security and/or law enforcement units.

The proposed method of protection against theft of funds during contact and contactless payment from a bank card, using the specified system containing interconnected, with the possibility of data exchange and interaction, processing center of the bank card issuer, processing center of the acquirer, plastic carrier of the bank card of the bank card holder , means of communication of a bank card holder with a number registered in the processing center of the issuer, or interconnected, with the possibility of data exchange and interaction, processing center of the bank card issuer, processing center of the acquirer, plastic carrier of the bank card of the bank card holder, means of communication of the bank card holder and at least one authorized representative of the bank card holder, with numbers registered in the issuer’s processing center, in which:

The issuer's processing center and the bank card holder's communication facility have the ability to exchange authenticated messages around the clock, or the processing center of the issuer and the means of communication of the bank card holder and at least one authorized representative of the bank card holder have the ability to exchange authenticated messages around the clock.

In addition, with the help of the issuer's processing center, limits are set on the size and number of debit transactions on the holder's bank card, and, at least on the basis of the established limits on debit transactions, a suspicious transaction is determined.

In this case, with the help of the issuer's processing center, a check of a suspicious transaction on the holder's bank card is initiated, at least in the case of a request from the holder's bank card for an expenditure transaction that exceeds the daily expenditure limit for the current day, and/or a check of the suspicious transaction is initiated with the help of the issuer's processing center by the holder’s bank card in the event of a request from the holder’s bank card for an expense transaction that exceeds the limit for a one-time amount of expenses, but does not exceed the daily expense limit, and/or initiates a check using the issuer’s processing center in the event of calculation by the anti-fraud system or the issuer’s fraud monitoring system , regardless of the presence and size of established limits on spending transactions on the holder's bank card, any suspicious transaction on the holder's card, characterized by at least a new type of product or service purchased by the holder and/or an atypical sequence of events in which the holder's bank card is used and/or unusual location, including geographical, of use of the holder’s bank card.

Alternatively, the issuer’s processing center searches for and determines the location of a technical device, at least a POS terminal, an ATM, a device for payments and money transfers on the Internet, through which a suspicious transaction was attempted from the holder’s bank card, indicating at least the unique network address used for the attempt conducting a transaction of a technical device and the necessary data of its owner, and also search and determine the mobile geolocation indicators of the location of the communication device of the bank card holder, at least at the time of an attempt to conduct a suspicious transaction from the holder’s bank card.

In most cases, the holder's bank card is made in the standard of at least EMV cards with two interfaces for the possibility of contact payment with a bank card with card entry, at least, in a POS terminal and contactless payment with a bank card without card entry, at least , into a POS terminal, with the ability to pay for purchases, at least when the card touches the POS terminal screen.

When using the holder's bank card for contactless payment, a limit on the one-time amount of expenses is set with the help of the processing center, if not exceeded, the PIN code of the bank card is not required to be entered.

At a minimum, in order to access all user data and capabilities of the communication device of the bank card holder, a function for unlocking the screen of the communication device is installed on the communication device using authentication using at least biometric data of the user, at least such as recognition by facial geometry and /or fingerprint recognition and/or iris recognition, and/or as a backup or separate key for screen unlocking, communication means use at least a digital screen unlock password, and/or for access to remote receipt of banking services issuer, on the means of communication of the bank card holder it is established, The application responsible for performing this function is at least a mobile bank, accessed using at least a mobile bank access PIN code and/or biometric data of the user, such as facial recognition and/or fingerprint recognition fingers and/or iris recognition.

To authenticate the holder and authorize his bank card for a spending transaction from the holder’s card, the size of which does not exceed the spending limit established by the issuer, if not exceeded, it is not necessary to initiate verification of a suspicious transaction or enter the PIN code of the bank card, the service is provided to the holder using the issuer’s processing center carrying out its additional authentication when requesting a contact or contactless expenditure transaction of any size from the holder’s card.

At the same time, to authenticate the holder and authorize his bank card for a spending transaction from the holder’s card, the size of which does not exceed the spending limit established by the issuer, if not exceeded, it is not necessary to initiate verification of a suspicious transaction or enter the PIN code of the bank card, the bank card holder connects at least At least in your mobile bank, the service of the issuer’s processing center carrying out its additional authentication when requesting a contact or contactless debit transaction of any size from your card.

After connecting the service of additional authentication of the holder by the issuer’s processing center when requesting a contact or contactless debit transaction of any size from his card, a response request is made using the issuer’s processing center to the holder’s communication facility to confirm additional authentication of the bank card holder.

When the holder’s communication device receives a response request from the issuer’s processing center to confirm additional authentication of the bank card holder, if the screen unlock function is installed on the holder’s communication device and at the time the response request is received, the holder’s communication device screen is locked, confirmation additional authentication of the bank card holder is carried out by unlocking the screen of the holder's communication device, or upon receipt of a response request from the issuer's processing center on the holder's communication device to confirm the additional authentication of the bank card holder, if the screen unlock function is not installed on the holder's communication device or at the time of receiving a response Upon request, the screen of the holder's communication device is unlocked, confirmation of additional authentication of the bank card holder is carried out by at least unlocking access to the issuer's mobile bank installed on the holder's communication device.

Providing the means of communication of the bank card holder with confirmation of additional authentication of the holder, through the screen unlocking function, is carried out at least according to the user’s biometric data, at least such as facial geometry recognition and/or fingerprint recognition and/or rainbow recognition shell of the eye, or providing the communication means of the bank card holder with confirmation of additional authentication of the holder, through the screen unlocking function, the means of communication are carried out at least by entering the screen unlock PIN code, or providing the communication means of the bank card holder with confirmation of additional authentication of the holder, through the access function at least to the mobile bank, is carried out by at least entering a PIN code for access to the mobile bank or biometric data of the user, at least such as facial geometry recognition and/or fingerprint recognition and/or recognition along the iris of the eye.

At the same time, the means of communication of the bank card holder provides confirmation of additional authentication of the holder through the function of unlocking the screen of the means of communication or the function of accessing at least a mobile bank installed on the means of communication by entering biometric data of the user, at least such as Recognition by facial geometry and/or recognition by fingerprints and/or recognition by iris is carried out by including the following elements on the communication device holder:

- in the case of fingerprint recognition - at least capacitive and/or optical and/or ultrasonic scanners, at the moment when a person places a finger or fingers on the specified area on the screen and/or communication device scanner;

- in the case of recognition by the iris of the eye - at least a biometric scanner with sensors - sensors that read the pattern of the iris of the eyes and/or sensors, cameras and a dot projector.

In a situation where additional authentication confirms the identity of the bank card holder, the requested transaction is allowed and carried out through the issuer’s processing center, and in a situation where it does not confirm, several additional attempts at additional authentication are offered via communication, and in case of non-confirmation, they are prohibited and blocked through the processing center. issuer center the requested transaction.

Alternatively, if after a certain number of attempts additional authentication does not confirm the identity of the bank card holder, photographing and/or video recording of the face and/or recording of biometric data of a potential attacker who is trying to carry out a contact or contactless debit transaction with a bank card is carried out using the holder’s communication means. card of the holder, and subsequent sending of the received data, at least to the processing center of the issuer, and/or in the case when a spending transaction is requested from the bank card of the holder, the size of which exceeds any spending limit established by the issuer on the card of the holder, is carried out by means of means of communication of the holder photographing and/or video recording of the person and/or recording the biometric data of a potential attacker who is trying to carry out a contact or contactless debit transaction from the holder’s bank card, and subsequent sending of the received data, at least to the issuer’s processing center.

Also, as an option, in the case when, when requesting a debit transaction from the holder’s bank card through an ATM, additional authentication does not confirm the identity of the bank card holder, photographing and/or video recording of the appearance and actions of a potential attacker is carried out using the ATM and/or the premises in which the ATM is located , which attempts to carry out a debit transaction from the holder’s bank card, and subsequently send the resulting photo and video materials to at least the issuer’s processing center.

In addition, as an option, in all cases where additional authentication does not confirm the identity of the bank card holder, the processing center of the issuer generates all materials received upon the fact of attempting a suspicious transaction from the bank card of the holder, at least photographs and/or video recordings of appearance and/or biometric data of a potential attacker, obtained through the communication means of the holder and/or the ATM and/or the premises in which the ATM is located, and the subsequent sending of such materials in the form of an authenticated message, at least to the means of communication of the authorized representative of the affected bank holder cards and/or authorized security and/or law enforcement units.

These essential features are interconnected to form a stable set of essential features sufficient to obtain the required technical result.

The distinctive features of the claimed invention were not discovered when searching for known systems and methods for a similar purpose, which indicates that this technical solution meets the conditions of patentability.

The present invention is illustrated by specific examples, which, however, they are not the only possible ones, but clearly demonstrate the possibility of achieving the required technical result by the given set of features.

Description of some of the embodiments of the invention of a system and method for protecting against theft of funds during contact and contactless payment from a bank card

In all embodiments of the present invention, the system for protecting against theft of funds during contact and contactless payment from a bank card contains interconnected, with the possibility of data exchange and interaction, a processing center of the bank card issuer, a processing center of the acquirer, a plastic carrier of the bank card of the bank card holder , a means of communication between the bank card holder and the number registered in the issuer’s processing center.

The processing center of the issuer or acquirer is known from the prior art and is an integral system, which is a complex of interconnected software and hardware solutions. The processing center ensures the life cycle of banking products based on bank cards and, accordingly, is responsible for conducting and managing related transactions. The processing center includes a number of subsystems, in particular:

- front office, which performs, in particular, authorization and capture of transactions, processing of communication and transactional traffic, conversion of a family of application protocols (in particular, SPDH, VISA-II, AP ACS for POS terminals, Diebold, NDC+ for ATMs);

- a back office that performs, in particular, management of the life cycle of bank cards, clearing - consolidation of data on transactions based on the results of a business day to carry out the procedure for mutual settlements between participants in the payment system (banks, retail chain enterprises, etc.);

- authorization subsystem, which is part of the front office, in particular, directly performing authorization functions (refusal/confirmation of transaction authorization);

- authentication server - in particular, provides authentication incoming requests/requests to change bank card limit parameters;

- a database of up-to-date information, in particular about bank cards, accounts, transactions and limits;

- database of bank card activity parameters - in particular, provides storage of registered mobile phone numbers of bank card holders and bank card activity parameters;

- automated data processing station (input and recognition of data from orders for the production of cards, slips, etc.);

- server for the system for generating statements for cardholders.

The following outlines the structure and operating principles of some variants of the present invention, while a detailed description of the known (in particular, from [DI], [D2]) aspects of the operation and interaction of processing center subsystems with each other and with bank cards is not given in this description , so as not to obscure its essence.

The holder's bank card is made in the standard, for example, EMV cards with two interfaces - for the possibility of contact payment with a bank card by entering the card into the POS terminal, as well as for the possibility of contactless payment with a bank card without entering the card into the POS terminal, with the ability to pay for purchases when the card touches the POS terminal screen.

As a means of communication for the bank card holder to exchange data and interact with the processing center of the bank card issuer, a smartphone is used, as an option - a mobile phone with a touch screen and a camera for photo and video shooting, complemented by the functionality of a pocket personal computer.

The issuer's processing center and the bank card holder's communication facility are designed with the ability to exchange authenticated messages around the clock.

Due to the fact that the communication number of the bank card holder is registered in the issuer's processing center, the bank card holder carries out authorization transactions using your bank card 24x7.

At the same time, the issuer sets, with or without the consent of the holders, various limits on the size and number of spending transactions on its bank cards. When implementing the present invention (as is the case in reality), the issuer must set a one-time spending limit for contactless payment for its debit and credit cards. Such a limit is, for example, 3 thousand rubles for a one-time amount of expenses from the card, if this limit is not exceeded, you do not need to enter the PIN code of the bank card.

To access all user data and capabilities of the communication device of the bank card holder, the function of unlocking the screen of the communication device using authentication is installed on his communication device - a smartphone. Such authentication is carried out, as an option, using the user’s biometric data, for example, such as facial geometry recognition, fingerprint recognition, iris recognition.

Also, as an additional key to unlock the screen of a communication device, a digital screen unlock password is used as an option.

In addition, to access the issuer’s banking services remotely, an application responsible for performing this function, for example, a mobile bank, is installed on the bank card holder’s communication device. To access the mobile bank, an optional mobile banking PIN code and/or user biometrics such as facial recognition, fingerprint recognition or iris recognition are used.

When requesting from the holder's bank card, for example, contactless payment of a one-time amount of expenses, the amount of which does not exceed the expense limit established by the issuer, if not exceeded, the PIN code of the bank card is not required to be entered, the issuer's processing center has the technical ability to respond to the holder's communication means for confirmation additional authentication of the bank card holder.

Option 1 - for contactless payment with a bank card

Let's consider the development of the situation when implementing this embodiment of the invention with contactless payment from a bank card:

Let's assume that a bank card user is going to pay with his contactless bank card for a purchase at a point of sale. The cashier-seller invites the buyer to pay, and the buyer brings his bank card to the contactless payment icon on the POS terminal. Information is transmitted electronically using a bank card chip to the processing center of the issuing bank.

The processing center of the issuing bank receives from its client’s bank card a request for a contactless spending transaction, the amount of which does not exceed the spending limit established by the issuer, if not exceeded, the bank card PIN code does not need to be entered.

In response to this request, the issuer's processing center sends an authenticated message to the means of communication - the holder's smartphone - with a response request to confirm additional authentication of its client - the bank card holder. To read this authenticated message on the locked screen of a smartphone, the user must have the Phone Lock Screen Notifications feature enabled on the smartphone.

Let us assume that at the moment the client’s smartphone receives a response request from the issuer’s processing center to confirm additional client authentication, the client’s smartphone screen is blocked. In this case, the client - bank card holder confirms his additional authentication by unlocking the screen of his smartphone.

To do this, the buyer puts away his bank card, takes out a smartphone, turns it on and looks at the smartphone screen. At this moment, with the help of sensors, cameras and a dot projector of a smartphone, the buyer is recognized by the geometry of his face. A signal about this goes to the issuer’s processing center and the buyer’s requested expense transaction is approved. The screen is unlocked and an authenticated message about the approval and execution of the expense transaction appears on it.

If an attacker tries to carry out a debit transaction using a contactless bank card and a smartphone that he stole from a specific bank card holder, the attacker will not be recognized and the debit transaction he requested will be rejected.

Option 2 - for contactless payment with a bank card

In this embodiment of the present invention, the system for protecting against theft of funds during contact and contactless payment from a bank card contains, in addition to interconnected, with the possibility of data exchange and interaction, a processing center of the bank card issuer, a processing center of the acquirer, a plastic carrier of the bank card bank card holder, a means of communication of the bank card holder, also a means of communication of at least one authorized representative of the bank card holder, with the number registered in the issuer's processing center.

The issuer's processing center and the means of communication of the bank card holder and at least one authorized representative of the bank card holder are designed with the ability to exchange authenticated messages around the clock.

The issuer's processing center is designed to search and determine the location of the technical device through which a suspicious transaction was attempted from the holder's bank card. Such devices can be POS terminals, ATMs, devices for payments and money transfers on the Internet. As a result of such a search, the unique network address of the technical device used to attempt a transaction and the necessary data of its owner are determined.

Also, the issuer’s processing center is designed with the ability to search and determine mobile geolocation indicators of the location of the fund communications of the bank card holder, including at the time of an attempt to conduct a suspicious transaction from the holder’s bank card.

Let us assume that at the moment the client’s smartphone receives a response request from the issuer’s processing center to confirm the client’s additional authentication, the client’s smartphone does not have the screen unlocking function installed or at the time the response request is received, the screen of the holder’s communication device is unlocked. In this case, the client - bank card holder confirms his additional authentication by unlocking access to the issuer's mobile bank installed on the client's communication device.

To do this, the buyer puts away his bank card, takes out a smartphone, turns it on and looks at the smartphone screen. At this moment, recognition occurs using sensors, cameras and a dot projector of the smartphone. buyer according to the geometry of his face. A signal about this goes to the issuer’s processing center and the buyer’s requested expense transaction is approved. The “Notifications” page of the issuer’s mobile bank is unlocked and an authenticated message about the approval and execution of the debit transaction appears on it.

At the same time, the smartphone takes photographs and videos of the attacker, as well as recording the attacker’s biometric data, in this case, the geometry of his face. The smartphone sends all of the listed materials and data on the attacker to the issuer’s processing center.

At the same time, the issuer's processing center searches and determines the location of the technical device through which a suspicious transaction was attempted from the client's bank card, in this case, a POS terminal of a retail outlet. As a result of such a search, the unique network address of the POS terminal used to attempt the transaction and the necessary data of its owner are determined.

At the same time, the issuer’s processing center searches and determines the mobile geolocation indicators of the location of the smartphone of its affected client, including at the time of an attempt to conduct a suspicious transaction from his bank card.

At the same time, the issuer’s processing center generates all the data received from the described fact of attempting a suspicious transaction from the bank card of its client (at least photographs and video recordings of the attacker’s appearance, his biometric data, the unique network address of the POS terminal of the trading points, mobile geolocation indicators of the location of the affected client’s smartphone).

As a result, the issuer’s processing center sends all data received from the described fact of attempting a suspicious transaction in the form of an authenticated message, at least to the communication means of the authorized representative of its affected client and authorized security and law enforcement units, who immediately begin measures to avoid leaving the dangerous the situation of the injured bank card holder and the detention of the offender.

Option 3 - with contact payment from a bank card

The holder of a bank card has set a daily spending limit on his card for contact and contactless payments in advance, for example, with such a limit amounting to 50,000 rubles. This service is provided by many issuing banks for their clients - holders of debit and credit plastic cards in order to protect against theft from the card. That is, if someone finds or steals a client’s card and/or smartphone or gains access to the client’s personal account in an online bank, they will not be able to steal from the client’s card and account an amount above the established daily spending limit, since the bank will reject all spending card transactions that exceed this limit.

Moreover, according to the present invention, the processing center of the bank card issuer, simultaneously with the rejection of all debit transactions on the card, performs the following actions:

- Search and determine the location of the technical device through which a suspicious transaction was attempted from the client’s bank card. As a result of such a search, the unique network address of the technical device used to attempt a transaction and the necessary data of its owner are determined.

Search and determine mobile geolocation indicators of the location of the affected client’s smartphone, including at the time of an attempt to conduct a suspicious transaction from his bank card. - Formation of all data received upon the attempted suspicious transaction from the bank card of one’s client (at least the unique network address used to attempt the transaction of a technical device and the necessary data of its owner, mobile geolocation indicators of the location of the affected client’s smartphone).

Sending all data received as a result of an attempted suspicious transaction in the form of authenticated messages, at least to the means of communication of the authorized representative of his affected client and authorized security and law enforcement units.

To protect against theft of funds during contact and contactless payments from his bank card in the event that the amount of attempted theft does not exceed the limit set on his card (in this case, the amount is 50,000 rubles), the specified conditional bank card holder connects in advance, for example, in your mobile bank, the service of the issuer’s processing center carrying out its additional authentication when requesting a contact or contactless debit transaction of any size from your card.

Next, let’s consider a situation where an attacker stole this holder’s smartphone and bank card along with its PIN code. The attacker goes to the ATM with the criminal intention of emptying the card of the affected holder - withdrawing all funds from the account of this bank card in cash. The attacker inserts the card into the card reader, dials the PIN code of this card and enters a request for a cash withdrawal of an amount that does not exceed the specified daily spending limit of 50,000 rubles established by the issuer (for example, on the first attempt, the attacker requests the withdrawal of 1,000 rubles from an ATM) .

In response, the ATM monitor displays the text “To approve your requested debit transaction, please confirm additional authentication on your phone.” At the same time, the issuer’s processing center sends an authenticated message of similar content to the stolen smartphone - with a response a request to confirm additional authentication of its client - the holder of a bank card.

The first scenario for the development of the situation: The criminal, realizing the failure of his criminal plan, does not take further action in his attempt to steal, does not look at the smartphone screen and leaves the premises where the ATM is located. However, the banking product is configured in such a way that non-completion of a debit transaction is perceived by the system as an attempt to conduct a suspicious transaction, and the processing center of the bank card issuer initiates and performs the following actions:

- Using video cameras of the ATM and/or the premises in which the ATM is located, photographing and/or filming the appearance of a potential attacker who is trying to carry out a debit transaction from the holder’s bank card, and then sending the resulting data to at least the issuer’s processing center.

- Search and determine the location of a technical device (in this case, an ATM), through which a suspicious transaction was attempted from the client’s bank card. As a result of such a search, the unique network address of the ATM used to attempt the transaction and the necessary data of its owner are determined.

Search and determine mobile geolocation indicators of the location of the affected client’s smartphone, including at the time of an attempt to conduct a suspicious transaction from his bank card.

- Formation of all data received upon the attempted suspicious transaction from the bank card of one’s client (at least the unique network address used to attempt the transaction of a technical device and the necessary data of its owner, mobile geolocation indicators of the location of the affected client’s smartphone).

Sending all data received upon attempting a suspicious transaction in the form of authenticated messages, at least on the means of communication of the authorized representative of his injured client and authorized security and law enforcement units, which immediately begin measures to not leave the injured cardholder in a dangerous situation and to detain the offender.

The second scenario for the development of the situation: The criminal, not immediately realizing the failure of his criminal plan, takes out a smartphone, turns it on and looks at the smartphone screen. At this moment, with the help of sensors, cameras and a dot projector of a smartphone, an attempt is made to recognize the affected cardholder by the geometry of his face. However, since the equipment analyzes another person instead of the true owner of the card and smartphone, it refuses to unlock the screen of the smartphone or mobile bank, and the debit transaction requested by the attacker at the ATM is rejected.

- At the same time, the issuer’s processing center uses video cameras of the ATM and/or the room in which the ATM is located to photograph and/or videotape the appearance of a potential attacker who is trying to carry out a debit transaction from the holder’s bank card, and then send the received data to at least , to the issuer's processing center.

At the same time, the issuer's processing center searches and determines the location of the technical device (in this case, an ATM) through which a suspicious transaction was attempted from the client's bank card. As a result of such a search, the unique network address of the ATM used to attempt the transaction and the necessary data of its owner are determined. zo

At the same time, the issuer’s processing center generates all the data received from the described fact of attempting a suspicious transaction from the bank card of its client (at least photographs and video recordings of the attacker’s appearance, his biometric data, the unique network address of the ATM and the data of its owner, mobile phone data, geolocation of the smartphone location of your affected client).

As a result, the issuer’s processing center sends all data received from the described fact of attempting a suspicious transaction in the form of authenticated messages, at least to the communication means of the authorized representative of its affected client and authorized security and law enforcement units, who immediately begin measures to not leave the person in danger. the situation of the injured bank card holder and the detention of the offender.

The specific examples described above can be used in many different similar embodiments of the present invention, for authorizing contact and contactless spending transactions of any size from bank cards and accounts, such as: cash withdrawals, payments for purchases or services, transfers to a card or account, and in any environment for using bank cards and accounts.

The present invention can also be effectively used to suppress and prevent numerous methods of theft of funds from bank cards and accounts in any environment of their use, including dangerous forms of theft of funds using violent actions that are dangerous to the health and life of bank card and account holders and witnesses of crimes.

The present invention is industrially applicable, since it can be implemented using known technologies used in banking payment systems, including to ensure the security of transactions in banking payment systems using bank cards.

Terminology used:

EMV standard is an international standard for transactions using bank cards with a chip. This standard was developed jointly by Europay, MasterCard and Visa to improve the security of financial transactions.

POS terminal is an electronic software and hardware device for accepting payment cards for payment. It can accept chip, magnetic stripe and contactless cards, as well as other devices that have contactless pairing. Also, a POS terminal often means the entire software and hardware complex that is installed at the cashier’s workplace.

Authorization is a set of operations to obtain permission or refusal provided by the issuing bank to carry out a transaction for a certain amount using a bank card, generating the issuer’s obligation to execute the transaction for the said amount, as a result of which the requested amount is blocked on the client’s account.

Authentication - confirmation of the authenticity of data and subjects of information interaction solely on the basis of the received data itself (when during information interaction the data is received from the declared sender and is not distorted).

Bank card holder (Cardholder) is an individual who uses the services of the issuing bank to carry out banking transactions, has an account with the bank, and is a user of the bank card on the basis of an agreement with the issuing bank.

Operation / Transaction (Transaction) - a set of sequential operations initiated by the client or payee carried out by participants of the payment system to serve clients - bank card holders (in particular, to access the account in order to obtain information about the account status, debit, credit the account, carry out financial settlements using banking cards).

Payment system (Payment system) - a system for the exchange of transactions and mutual settlements between the parties participating in the system using a set of information and technical means of the participating parties, subject to general regulatory rules for the transfer of financial resources between banks and other financial institutions, which is characterized by the presence of contractual and licensing base, trademark, financial guarantees, internal operating rules and standards.

The issuer's processing center and the acquirer's processing center are structural divisions of the issuer and acquirer banks that carry out information and technological interaction between settlement participants and ensure intra-bank processing of transactions with plastic cards.

Acquirer is a bank or company that carries out the full range of operations to interact with bank card service points, which consists of terminals in the trade and service network and ATMs.

Issuer - a credit institution that issues cards. The issuer guarantees the fulfillment of financial obligations associated with the use of a plastic card issued by it as a means of payment.

Claims

33 FORMULA OF THE INVENTION

1. A system for protecting against theft of funds during contact and contactless payment from a bank card, containing, interconnected, with the possibility of data exchange and interaction, a processing center of the bank card issuer, a processing center of the acquirer, a plastic carrier of the bank card of the bank card holder, a means of communication bank card holder with a number registered in the issuer's processing center, or interconnected, with the possibility of data exchange and interaction, the processing center of the bank card issuer, the acquirer's processing center, the plastic carrier of the bank card of the bank card holder, the means of communication of the bank card holder and, at least at least one authorized representative of the bank card holder, with numbers registered in the issuer’s processing center; the issuer's processing center and the communication means of the bank card holder are configured with the ability to exchange authenticated messages around the clock, or the issuer's processing center and the communication means of the bank card holder and at least one authorized representative of the bank card holder are configured with the ability to exchange authenticated messages around the clock ; the issuer's processing center is configured to set limits on the size and number of debit transactions on the holder's bank card and, at least based on the established limits on debit transactions, a suspicious transaction is determined; wherein the issuer's processing center is configured to initiate verification of a suspicious transaction on the holder's bank card, at least in the event of a request from the holder's bank card for a spending transaction that exceeds the daily spending limit on the current day, 34 and/or the issuer's processing center is configured to initiate verification of a suspicious transaction on the holder's bank card in the event of a request from the holder's bank card for an expense transaction that exceeds the limit on a one-time amount of expenses, but does not exceed the daily expense limit, and/or the issuer's processing center is configured with the ability to initiate a check if the anti-fraud system or the issuer's fraud monitoring system, regardless of the presence and size of the established limits on spending transactions on the holder's bank card, calculates any suspicious transaction on the holder's card, characterized by at least a new type of product purchased by the holder or services and/or an atypical sequence of events in which the holder’s bank card is used and/or an unusual location, including geographic, of use of the holder’s bank card; The issuer's processing center is configured to search and determine the location of a technical device, at least a POS terminal, an ATM, a device for payments and money transfers on the Internet, through which a suspicious transaction was attempted from the holder's bank card, indicating at least , a unique network address used to attempt to conduct a transaction of a technical device and the necessary data of its owner, as well as to search and determine the mobile geolocation indicators of the location of the bank card holder’s communication device, at least at the time of an attempt to conduct a suspicious transaction from the holder’s bank card; The holder's bank card is made in the standard of at least an EMV card and has two interfaces for the possibility of contact payment with a bank card with the card being entered into at least a POS terminal and contactless payment with a bank card without entering the card at least in POS terminal, with the ability to pay for purchases, at least when the card touches the POS terminal screen; when using the holder's bank card for contactless payment, the issuer has set a limit on the one-time amount of expenses, if not exceeded, the bank card PIN code does not need to be entered; as a means of communication for the bank card holder to exchange data and interact with the processing center of the bank card issuer, at least a smartphone is used - a mobile phone with a touch screen and a camera for photo and video shooting, complemented by the functionality of a pocket personal computer; at least for access to all user data and capabilities of the communication device of the bank card holder, a function of unlocking the screen of the communication device is installed on the communication device using authentication, at least according to the user’s biometric data, at least such as recognition by facial geometry and /or fingerprint recognition and/or iris recognition, and/or at least a digital screen unlock password is used as a backup or separate key for unlocking the screen of a communication device, and/or for access to remote receipt of banking services issuer, an application responsible for performing this function is installed on the communication device of the bank card holder, at least a mobile bank, for access to which at least the PIN code for access to the mobile bank and/or biometric data of the user is used, such as facial geometry recognition and/or fingerprint recognition and/or iris recognition; to authenticate the holder and authorize his bank card for a spending transaction from the holder’s card, the size of which does not exceed the spending limit established by the issuer, if not exceeded, it is not necessary to initiate verification of a suspicious transaction or enter the PIN code of the bank card, the processing center of the bank card issuer has the technical ability to provide the holder of the service to carry out his additional authentication upon request from the card holder of the contact or contactless spending transactions of any size; or to authenticate the holder and authorize his bank card for a spending transaction from the holder’s card, the size of which does not exceed the spending limit established by the issuer, if not exceeded, it is not necessary to initiate verification of a suspicious transaction or enter the PIN code of the bank card, the bank card holder has the technical ability to at least, in your mobile bank, connecting the service of the issuer’s processing center for its additional authentication when requesting a contact or contactless debit transaction of any size from your card; after connecting the service of additional authentication of the holder by the issuer’s processing center when requesting a contact or contactless debit transaction of any size from his card, the issuer’s processing center has the technical ability to respond to a request to the holder’s communication means to confirm additional authentication of the bank card holder; upon receipt of a response request from the issuer's processing center on the holder's communication device to confirm the additional authentication of the bank card holder, if the screen unlocking function is installed on the holder's communication device and at the time of receiving the response request the holder's communication device screen is locked, confirmation of the additional authentication of the bank card holder is carried out by unlocking the screen of the holder's communication device, or when the holder's communication device receives a response request from the issuer's processing center to confirm additional authentication of the bank card holder, if the holder's communication device does not have the screen unlocking function installed or at the time of receiving the response request, the holder's communication device screen is unlocked, confirmation of additional authentication of the bank card holder is carried out by at least unlocking access to the issuer's mobile bank installed on the holder's communication device; 37 providing the means of communication of the bank card holder with confirmation of additional authentication of the holder, through the screen unlocking function, is carried out at least according to the user’s biometric data, at least such as recognition by facial geometry and/or recognition by fingerprints and/or recognition by iris of the eye, or providing the communication device for the bank card holder with confirmation of additional authentication of the holder, through the screen unlocking function of the communication device, is carried out at least by entering the screen unlock PIN code, or providing the communication device for the bank card holder with confirmation of additional authentication of the holder, through the function access to at least the mobile bank is carried out by at least entering a mobile bank access PIN or user biometric data, at least such as facial recognition and/or fingerprint recognition and/or iris recognition; providing the communication device for the bank card holder with confirmation of additional authentication of the holder through the screen unlocking function of the communication device or the access function to at least a mobile bank installed on the communication device by entering biometric data of the user, at least such as recognition by facial geometry and /or fingerprint recognition and/or iris recognition is carried out by turning on the following elements on the holder's communication device: in the case of facial geometry recognition - at least sensors, cameras and a dot projector, at the moment when a person looks at the screen and/or to the front camera of the communication device, in the case of fingerprint recognition - at least capacitive and/or optical and/or ultrasonic scanners, at the moment when 38 a person places a finger or fingers on a specified area on the screen and/or scanner of a communication device, in the case of recognition by the iris of the eye - at least a biometric scanner with sensors - sensors that read the pattern of the iris of the eyes and/or sensors, cameras and point projector; in a situation where additional authentication confirms the identity of the bank card holder, the issuer's processing center has the technical ability to authorize and carry out the requested transaction, and in a situation where it does not confirm, the communication facility has the technical ability to offer several additional attempts at additional authentication, and in case of non-confirmation - the processing center the issuer's center has the technical ability to prohibit and block the requested transaction; in the case when, after a certain number of attempts, additional authentication does not confirm the identity of the bank card holder, the holder’s communication device has the technical ability to photograph and/or videotape the face and/or record the biometric data of a potential attacker who is trying to carry out a contact or contactless debit transaction from the holder’s bank card , and subsequent sending of the received data, at least to the issuer’s processing center, and/or in the case when an expense transaction is requested from the holder’s bank card, the size of which exceeds any expense limit established by the issuer on the holder’s card, the holder’s means of communication has the technical possibility of photographing and/or video recording the face and/or recording the biometric data of a potential attacker who is trying to carry out a contact or contactless debit transaction from the holder’s bank card, and then sending the received data to at least the issuer’s processing center; in the case when, when requesting an expense transaction from a bank card from the holder’s card through an ATM, additional authentication does not confirm 39 the identity of the bank card holder, the ATM and/or the premises in which the ATM is located has the technical ability to photograph and/or videotape the appearance and actions of a potential attacker who is trying to carry out a debit transaction from the holder’s bank card, and then send the resulting photo and video materials, at least to the processing center of the issuer; in all cases where additional authentication does not confirm the identity of the bank card holder, the issuer's processing center has the technical ability to generate all materials received upon the fact of attempting a suspicious transaction from the bank card of the holder, at least photographs and/or video recordings of appearance and/or biometric data potential attacker, received through the communication means of the holder and/or ATM and/or the premises in which the ATM is located, and subsequent sending of such materials in the form of an authenticated message, at least to the means of communication of the authorized representative of the affected bank card holder and/or authorized security and/or law enforcement units.

2. A method of protecting against theft of funds during contact and contactless payment from a bank card, using the system according to claim 1, containing interconnected, with the possibility of data exchange and interaction, the processing center of the bank card issuer, the acquirer’s processing center, the plastic carrier of the bank card cards of a bank card holder, a means of communication of a bank card holder with a number registered in the processing center of the issuer, or interconnected, with the possibility of data exchange and interaction, processing center of a bank card issuer, processing center of an acquirer, plastic carrier of a bank card of a bank card holder, means of communication bank card holder and at least one authorized representative of the bank card holder, with numbers registered in the issuer's processing center, in which: 40, the issuer's processing center and the communication facility of the bank card holder have the ability to exchange authenticated messages around the clock, or the issuer's processing center and the communication facility of the bank card holder and at least one authorized representative of the bank card holder have the ability to exchange authenticated messages around the clock; set, with the help of the issuer's processing center, limits on the size and number of debit transactions on the holder's bank card, and, at least on the basis of the established limits on debit transactions, identify a suspicious transaction; at the same time, with the help of the issuer's processing center, a check of a suspicious transaction on the holder's bank card is initiated, at least in the case of a request from the holder's bank card for an expenditure transaction that exceeds the daily expenditure limit for the current day, and/or a check of the suspicious transaction is initiated, with the help of the issuer's processing center by the holder’s bank card in the event of a request from the holder’s bank card for an expense transaction that exceeds the limit for a one-time amount of expenses, but does not exceed the daily expense limit, and/or initiates a check using the issuer’s processing center in the event of calculation by the anti-fraud system or the issuer’s fraud monitoring system , regardless of the presence and size of established limits on spending transactions on the holder's bank card, any suspicious transaction on the holder's card, characterized by at least a new type of product or service purchased by the holder and/or an atypical sequence of events in which the holder's bank card is used and/or unusual location, including geographical, of use of the holder’s bank card; carry out, through the processing center of the issuer, a search and determination of the location of a technical device, at least a POS- 41 terminal, ATM, device for payments and money transfers on the Internet, through which a suspicious transaction was attempted from the holder’s bank card, indicating at least the unique network address used to attempt the transaction of the technical device and the necessary data of its owner, and also search and determine the mobile geolocation indicators of the location of the communication device of the bank card holder, at least at the time of an attempt to conduct a suspicious transaction from the holder’s bank card; The holder's bank card is made in the standard of at least EMV cards with two interfaces for the possibility of contact payment with a bank card with the card entered into at least a POS terminal and contactless payment with a bank card without the card being entered at least in a POS -terminal, with the ability to pay for purchases, at least when the card touches the POS terminal screen; when using the holder’s bank card for contactless payment, a limit on the one-time amount of expenses is set with the help of the processing center, if not exceeded, the PIN code of the bank card is not required to be entered; as a means of communication for the bank card holder to exchange data and interact with the processing center of the bank card issuer, at least a smartphone is used - a mobile phone with a touch screen and a camera for photo and video shooting, supplemented with the functionality of a pocket personal computer; at least for access to all user data and capabilities of the communication device of the bank card holder, a function of unlocking the screen of the communication device is installed on the communication device using authentication using at least biometric data of the user, at least such as recognition by facial geometry and /or fingerprint recognition and/or iris recognition, 42 and/or as a backup or separate key for unlocking the screen, the communication means use at least a digital password for unlocking the screen, and/or for access to remote receipt of banking services of the issuer, the person responsible for performing this is installed on the communication means of the bank card holder functions an application, at least a mobile bank, accessed using at least a mobile bank access PIN code and/or user biometrics, such as facial recognition and/or fingerprint recognition and/or iris recognition; to authenticate the holder and authorize his bank card for a spending transaction from the holder’s card, the size of which does not exceed the spending limit established by the issuer, if not exceeded, it is not necessary to initiate verification of a suspicious transaction or enter the PIN code of the bank card, the service is provided to the holder using the issuer’s processing center carrying out its additional authentication when requesting a contact or contactless expenditure transaction of any size from the holder’s card; or to authenticate the holder and authorize his bank card for a spending transaction from the holder's card, the size of which does not exceed the spending limit established by the issuer, if not exceeded, it is not necessary to initiate verification of a suspicious transaction or enter the PIN code of the bank card, the bank card holder connects at least , in your mobile bank, the service of the issuer’s processing center carrying out its additional authentication when requesting a contact or contactless debit transaction of any size from your card; after connecting the service of additional authentication of the holder by the issuer's processing center when requesting a contact or contactless expenditure transaction of any size from his card, a response request to the communication facility is made using the issuer's processing center 43 holders to confirm additional authentication of the bank card holder; upon receipt of a response request from the issuer's processing center on the holder's communication device to confirm the additional authentication of the bank card holder, if the screen unlocking function is installed on the holder's communication device and at the time of receiving the response request the holder's communication device screen is locked, confirmation of the additional authentication of the bank card holder is carried out by unlocking the screen of the holder's communication device, or when the holder's communication device receives a response request from the issuer's processing center to confirm additional authentication of the bank card holder, if the holder's communication device does not have the screen unlocking function installed or at the time of receiving the response request, the holder's communication device screen is unlocked, confirmation of additional authentication of the bank card holder is carried out by at least unlocking access to the issuer's mobile bank installed on the holder's communication device; Providing a means of communication for the bank card holder with confirmation of additional authentication of the holder, through the screen unlocking function, is carried out at least according to the user’s biometric data, at least such as facial geometry recognition and/or fingerprint recognition and/or rainbow recognition shell of the eye, or providing the communication means of the bank card holder with confirmation of additional authentication of the holder, through the screen unlocking function, the means of communication are carried out at least by entering the screen unlock PIN code, or providing the communication means of the bank card holder with confirmation of additional authentication of the holder, through the access function at least to the mobile bank, is carried out at least by entering the PIN code for access to the mobile bank or 44 user biometric data such as facial geometry recognition and/or fingerprint recognition and/or iris recognition; providing the communication device for the bank card holder with confirmation of additional authentication of the holder through the screen unlocking function of the communication device or the access function to at least a mobile bank installed on the communication device by entering biometric data of the user, at least such as recognition by facial geometry and /or recognition by fingerprints and/or recognition by iris of the eye is carried out by turning on the following elements on the communication device of the holder: in the case of recognition by facial geometry - at least sensors, cameras and a dot projector, at the moment when a person looks at the screen and/or on the front camera of a communication device, in the case of fingerprint recognition - at least capacitive and/or optical and/or ultrasonic scanners, at the moment when a person places a finger or fingers on the specified area on the screen and/or scanner of the device communication, in the case of iris recognition - at least a biometric scanner with sensors - sensors that read the pattern of the iris and/or sensors, cameras and a dot projector; in a situation where additional authentication confirms the identity of the bank card holder, the requested transaction is allowed and carried out through the issuer’s processing center, and in a situation where it does not confirm, several additional attempts at additional authentication are offered via communication, and in case of non-confirmation, they are prohibited and blocked through the processing center issuer center the requested transaction; in the case when, after a certain number of attempts, additional authentication does not confirm the identity of the bank card holder, photography and/or 45 video recording of a face and/or recording of biometric data of a potential attacker who is trying to carry out a contact or contactless debit transaction from the holder’s bank card, and subsequent sending of the received data, at least to the processing center of the issuer, and/or in the case when from the bank card card holder, a spending transaction is requested, the size of which exceeds any spending limit established by the issuer on the holder’s card, photographing and/or video recording of the face and/or recording of biometric data of a potential attacker who is trying to carry out a contact or contactless spending transaction with a bank account is carried out using the holder’s communication device holder's card, and subsequent sending of the received data to at least the issuer's processing center; in the case when, when requesting a debit transaction from the holder's bank card through an ATM, additional authentication does not confirm the identity of the bank card holder, photographing and/or video recording of the appearance and actions of the potential attacker who is trying to carry out debit transaction from the holder’s bank card, and subsequent sending of the received photo and video materials, at least to the issuer’s processing center; in all cases when additional authentication does not confirm the identity of the bank card holder, the issuer’s processing center generates all materials received upon the fact of attempting a suspicious transaction from the bank card holder, at least photographs and/or video recordings of the appearance and/or biometric data of the potential attacker received using the communication means of the holder and/or the ATM and/or the premises in which the ATM is located, and the subsequent sending of such materials in the form of an authenticated message, at least to the communication means 46 authorized representative of the affected bank card holder and/or authorized security and/or law enforcement units.